Allow premium users to upload themes using a deck token

DeckThemes · Mar 2, 2024 · d2c723f · d2c723f
1 parent a4c4d2a
commit d2c723f
Show file tree

Hide file tree

Showing 6 changed files with 17 additions and 3 deletions.
diff --git a/DeckPersonalisationApi/Controllers/BlobController.cs b/DeckPersonalisationApi/Controllers/BlobController.cs
@@ -88,7 +88,7 @@ public IActionResult GetBlobsFromUser()
 
     [HttpPost]
     [Authorize]
-    [JwtRoleReject(Permissions.FromApiToken)]
+    [JwtRoleReject(Permissions.FromApiToken, true)]
     public IActionResult PostBlob(IFormFile file)
     {
         UserJwtDto dto = _jwt.DecodeToken(Request).Require();

diff --git a/DeckPersonalisationApi/Controllers/SubmissionController.cs b/DeckPersonalisationApi/Controllers/SubmissionController.cs
@@ -64,7 +64,7 @@ public IActionResult SubmitAudioPackViaGit(GitSubmitPostDto post)
 
     [HttpPost("css_zip")]
     [Authorize]
-    [JwtRoleReject(Permissions.FromApiToken)]
+    [JwtRoleReject(Permissions.FromApiToken, true)]
     public IActionResult SubmitCssThemeViaZip(ZipSubmissionPostDto post)
     {
         UserJwtDto dto = _jwt.DecodeToken(Request).Require("Could not find user");

diff --git a/DeckPersonalisationApi/Middleware/JwtRole/JwtRoleAttributeMiddleware.cs b/DeckPersonalisationApi/Middleware/JwtRole/JwtRoleAttributeMiddleware.cs
@@ -1,4 +1,5 @@
 using DeckPersonalisationApi.Exceptions;
+using DeckPersonalisationApi.Model;
 using DeckPersonalisationApi.Model.Dto.External.GET;
 using DeckPersonalisationApi.Services;
 using Microsoft.AspNetCore.Http.Features;
@@ -30,7 +31,7 @@ public async Task InvokeAsync(HttpContext context, JwtService jwt)
                 if (user == null)
                     throw new UnauthorisedException("Failed to decode JWT");
 
-                if (reject != null)
+                if (reject != null && !(reject.OnlyIfNotPremium && user.HasPermission(Permissions.IsPremium)))
                     user.RejectPermission(reject.Reject);
 
                 if (require != null)

diff --git a/DeckPersonalisationApi/Middleware/JwtRole/JwtRoleReject.cs b/DeckPersonalisationApi/Middleware/JwtRole/JwtRoleReject.cs
@@ -6,8 +6,16 @@ public class JwtRoleReject : Attribute
 {
     public Permissions Reject { get; set; }
 
+    public bool OnlyIfNotPremium { get; set; }
+
     public JwtRoleReject(Permissions reject)
     {
         Reject = reject;
     }
+
+    public JwtRoleReject(Permissions reject, bool onlyIfNotPremium)
+    {
+        Reject = reject;
+        OnlyIfNotPremium = onlyIfNotPremium;
+    }
 }
diff --git a/DeckPersonalisationApi/Model/Dto/External/GET/UserJwtDto.cs b/DeckPersonalisationApi/Model/Dto/External/GET/UserJwtDto.cs
@@ -1,4 +1,5 @@
 using DeckPersonalisationApi.Exceptions;
+using DeckPersonalisationApi.Services;
 
 namespace DeckPersonalisationApi.Model.Dto.External.GET;
 
@@ -31,6 +32,9 @@ public UserJwtDto(User user)
         Permissions = user.Permissions;
         Avatar = user.GetAvatarUri()?.AbsoluteUri ?? "";
         ValidationToken = user.ValidationToken;
+
+        if (DiscordBot.Instance.PermissionStateOfUser(Id) != "None")
+            Permissions |= Permissions.IsPremium;
     }
 
     public bool HasPermission(Permissions permission)

diff --git a/DeckPersonalisationApi/Model/Permissions.cs b/DeckPersonalisationApi/Model/Permissions.cs
@@ -10,6 +10,7 @@ public enum Permissions
     ManageApi = 0x4,
     FromApiToken = 0x8,
     ViewThemeSubmissions = 0x10,
+    IsPremium = 0x20,
 }
 
 public static class PermissionExt